Jump to content
Sign in to follow this  
The AchieVer

Intel Patches Multiple Security Flaws – Fixes Rolled Out Alongside Patch Tuesday

Recommended Posts

The AchieVer

This week has been quite busy for users having to update their systems. The tech giants like Microsoft and Adobe have rolled-out their monthly Patch Tuesdayupdates. It seems Intel didn’t want to miss this important time, and so, they have also released security fixes. Reportedly, the recently released Intel patches addressed multiple security flaws that affected its different products.

Intel Patches Three High-Severity Security Flaws

The Intel patches include fixes for three high-severity security bugs that could result in privilege escalation.

The first vulnerability existed in Intel® PROSet/Wireless WiFi Software. Exploiting this bug could allow escalation of privileges to an potential attacker. As explained by Intel in the security advisory,

“Improper directory permissions in the ZeroConfig service in Intel(R) PROSet/Wireless WiFi Software before version 20.90.0.7 may allow an authorized user to potentially enable escalation of privilege via local access.”

The vulnerability, CVE-2018-12177, achieved a CVSS base score of 7.8 – the highest of all vulnerabilities patched with this update bundle. Intel has recommended that users update their systems to Intel® PROSet/Wireless WiFi Software version 20.90.0.7 or later.

The second vulnerability (CVE-2018-18098) affected Intel® SGX SDK and Intel® SGX Platform Software. Describing the bug, Intel state:

“Improper file verification in install routine for Intel(R) SGX SDK and Platform Software for Windows before 2.2.100 may allow an escalation of privilege via local access.”

Intel has patched this flaw, together with a medium-severity bug (discussed below) in the latest software versions. These include,

  • Intel® SGX Platform Software for Windows version 2.2.100 or later
  • Intel® SGX Platform Software for Linux version 2.4.100 or later
  • Intel® SGX SDK for Windows version 2.2.100 or later
  • Intel® SGX SDK for Linux version 2.4.100

The third bug, CVE-2019-0088, affected the Intel® System Support Utility for Windows. Explaining about it, Intel states:

“Insufficient path checking in Intel(R) System Support Utility for Windows before 2.5.0.15 may allow an authenticated user to potentially enable an escalation of privilege via local access.”

Intel has patched the flaw in Intel® System Support Utility for Windows v.2.5.0.15 and later. Thus, the users may upgrade their systems with the patched version.

Multiple Medium-Severity Bugs Also Fixed

Among the medium-severity bugs, the first one targeted the Intel® SGX SDK and Intel® SGX Platform Software (CVE-2018-12155). Exploiting this flaw could result in information disclosure. As described by Intel in the advisory,

“Data leakage in cryptographic libraries for Intel(R) IPP before 2019 update 1 release may allow an unprivileged user to cause information disclosure via local access.”

Another medium severity bug (CVE-2018-12166) affected Intel® Optane™ SSD DC P4800X that may trigger denial-of-service. According to Intel,

“Insufficient write protection in firmware for Intel(R) Optane(TM) SSD DC P4800X before version E2010435 may allow a privileged user to potentially enable a denial of service via local access.”

In addition to the above, Intel also released fixes for two more privilege escalation bugs having medium severity ratings. These include CVE-2018-3703 that affected Intel® SSD Data Center Tool for Windows and CVE-2017-3718 that threatened the system firmware for Intel® NUC.

 

 

Source

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...